Malware Analysis Report

2025-01-02 07:21

Sample ID 240916-xk8l6athjh
Target 7ZSfxMod
SHA256 b2afdcbf92f1b41139d177ef0f232631b25f5b05731b7348de0ad7ef89ed51a1
Tags
floxif sality backdoor discovery evasion trojan upx defense_evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b2afdcbf92f1b41139d177ef0f232631b25f5b05731b7348de0ad7ef89ed51a1

Threat Level: Known bad

The file 7ZSfxMod was found to be: Known bad.

Malicious Activity Summary

floxif sality backdoor discovery evasion trojan upx defense_evasion

Floxif, Floodfix

Modifies firewall policy service

Sality

Windows security bypass

UAC bypass

Detects Floxif payload

ACProtect 1.3x - 1.4x DLL software

Windows security modification

Checks computer location settings

Loads dropped DLL

UPX packed file

System Binary Proxy Execution: Rundll32

Checks whether UAC is enabled

Checks installed software on the system

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-16 18:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-16 18:55

Reported

2024-09-16 18:58

Platform

win7-20240903-en

Max time kernel

120s

Max time network

125s

Command Line

"taskhost.exe"

Signatures

Floxif, Floodfix

backdoor trojan floxif

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Detects Floxif payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\symsrv.dll C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created \??\c:\program files\common files\system\symsrv.dll.000 C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2248 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\taskhost.exe
PID 2248 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\Dwm.exe
PID 2248 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\Explorer.EXE
PID 2248 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe

"C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 5isohu.com udp
US 8.8.8.8:53 www.aieov.com udp
US 173.255.194.134:80 www.aieov.com tcp

Files

C:\Program Files\Common Files\System\symsrv.dll

MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

memory/2248-33-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-34-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-32-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-29-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-31-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-13-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-12-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-30-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2248-27-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-26-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2248-28-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-25-0x0000000000540000-0x0000000000541000-memory.dmp

memory/2248-23-0x0000000000540000-0x0000000000541000-memory.dmp

memory/2248-22-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/1120-15-0x0000000001B40000-0x0000000001B42000-memory.dmp

memory/2248-14-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-39-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-8-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-7-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2248-6-0x000000000040F000-0x0000000000413000-memory.dmp

memory/2248-4-0x0000000010000000-0x0000000010030000-memory.dmp

memory/2248-0-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2248-41-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-40-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-44-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-45-0x0000000010000000-0x0000000010030000-memory.dmp

memory/2248-57-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2248-47-0x0000000002860000-0x00000000038EE000-memory.dmp

memory/2248-65-0x0000000010000000-0x0000000010030000-memory.dmp

memory/2248-64-0x0000000000400000-0x0000000000434000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-16 18:55

Reported

2024-09-16 18:58

Platform

win10v2004-20240802-en

Max time kernel

97s

Max time network

151s

Command Line

"fontdrvhost.exe"

Signatures

Floxif, Floodfix

backdoor trojan floxif

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Detects Floxif payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

System Binary Proxy Execution: Rundll32

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\uTorrent\utorrent.inf C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\updates C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\settings.dat C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\Tools\nircmdc.exe C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\Tools C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\dlimagecache C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\ie C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\utorrent.lng C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\utorrent.exe C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\share C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\updates C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\Tools\1.cmd C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\Tools\new_put.cmd C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\utorrent.inf C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\utorrent.lng C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\apps C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\share C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\Tools\1.cmd C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\Tools\new_put.cmd C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\utorrent.inf C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files\Common Files\System\symsrv.dll C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\settings.dat C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\utorrent.exe C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\ie C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\Tools\nircmdc.exe C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created \??\c:\program files\common files\system\symsrv.dll.000 C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File created C:\Program Files (x86)\uTorrent\apps C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
File opened for modification C:\Program Files (x86)\uTorrent\dlimagecache C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1616 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\fontdrvhost.exe
PID 1616 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\fontdrvhost.exe
PID 1616 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\dwm.exe
PID 1616 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\sihost.exe
PID 1616 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\svchost.exe
PID 1616 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\taskhostw.exe
PID 1616 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\Explorer.EXE
PID 1616 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\svchost.exe
PID 1616 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\DllHost.exe
PID 1616 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1616 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\RuntimeBroker.exe
PID 1616 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1616 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\RuntimeBroker.exe
PID 1616 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1616 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\RuntimeBroker.exe
PID 1616 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\cmd.exe
PID 1616 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 2264 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1776 wrote to memory of 2264 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1776 wrote to memory of 2168 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 1776 wrote to memory of 2168 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 1616 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\cmd.exe
PID 1616 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\cmd.exe
PID 4352 wrote to memory of 1536 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4352 wrote to memory of 1536 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4352 wrote to memory of 3592 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 4352 wrote to memory of 3592 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 1616 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SysWOW64\cmd.exe
PID 1616 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SysWOW64\cmd.exe
PID 1616 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SysWOW64\cmd.exe
PID 1616 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SysWOW64\rundll32.exe
PID 1616 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SysWOW64\rundll32.exe
PID 1616 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SysWOW64\rundll32.exe
PID 1616 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\cmd.exe
PID 1616 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\cmd.exe
PID 1616 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\fontdrvhost.exe
PID 1616 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\fontdrvhost.exe
PID 1616 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\dwm.exe
PID 1616 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\sihost.exe
PID 1616 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\svchost.exe
PID 1616 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\taskhostw.exe
PID 1616 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\Explorer.EXE
PID 1616 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\svchost.exe
PID 1616 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\system32\DllHost.exe
PID 1616 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1616 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\RuntimeBroker.exe
PID 1616 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1616 wrote to memory of 3532 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\RuntimeBroker.exe
PID 1616 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1616 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe

"C:\Users\Admin\AppData\Local\Temp\7ZSfxMod.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c Ver | Find "6." >Nul && Echo PROG_SDIR2 ="..\..\..\..\..\..\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch">>utorrent.inf

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" Ver "

C:\Windows\system32\find.exe

Find "6."

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c Ver | Find "6." >Nul || Echo PROG_SDIR2= "..\..\Application Data\Microsoft\Internet Explorer\Quick Launch">>utorrent.inf

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" Ver "

C:\Windows\system32\find.exe

Find "6."

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c Move utorrent.inf C:\Windows\INF

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" advpack,LaunchINFSection utorrent.inf,DefaultInstall_x64,0

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c rd /s /q "C:\Program Files (x86)\uTorrent\Tools"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 5isohu.com udp
US 8.8.8.8:53 www.aieov.com udp
US 45.33.18.44:80 www.aieov.com tcp
US 8.8.8.8:53 44.18.33.45.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 5isohu.com udp
US 45.33.18.44:80 www.aieov.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/1616-0-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Program Files\Common Files\System\symsrv.dll

MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

memory/1616-5-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1616-7-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-10-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-9-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-11-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-12-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-24-0x0000000004AD0000-0x0000000004AD2000-memory.dmp

memory/1616-26-0x0000000004AD0000-0x0000000004AD2000-memory.dmp

memory/1616-27-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1616-20-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-22-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-25-0x0000000004C20000-0x0000000004C21000-memory.dmp

memory/1616-13-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-21-0x000000000040F000-0x0000000000413000-memory.dmp

memory/1616-23-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-28-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-29-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-31-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-35-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-36-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-39-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1616-54-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-55-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Program Files (x86)\uTorrent\utorrent.inf

MD5 0e3322acf2d84d1671282b825665e788
SHA1 0125ccae40eeecd964c3b2f9cc1155eb79879fc2
SHA256 bc276018078803c1506dd23a9a0dd3f94e4262d73943fdb70f2a32dd13bc6e70
SHA512 1af819951f68037b6c081ad85c2171945a464303fb80a745bcefdf703dfe7581bca2c648e1424eb4edca27af0ef9af0d000ba89abedd3953cf741cf23f394e76

C:\Program Files (x86)\uTorrent\utorrent.inf

MD5 90ad6a5f0c853afffe8ac0f435ceb653
SHA1 1a012dcd3b0809e822907175073d280a56b6b8b8
SHA256 666ecfc1209a81b001d99373e15efcc39a7d2986528596c649c21373eaea63e2
SHA512 60acbbcd17ca2bd65f6ee82b9b0f36d08263eaebeb2aa0cf401a7528577e19f1b36c5006306c384e394cca888756803cfb8f7894a6d12c692a276f3404f103a3

C:\Program Files (x86)\uTorrent\utorrent.exe

MD5 409179273c5f70a46d868b6e928d262f
SHA1 8ac172017f92c0ca70f200cdda017fc96764b8dd
SHA256 6b3e21d568c9305c5ab205341c6d0f943cbec5f8f04b67d9d7230f1f1e40f8f2
SHA512 0c2c9ae5a16438bb14d7d407856dfbbac4eb697166231ef32c7cc791ac55e4833de6d81dcaf61a690918f75a95e9eae79cb2a543b38ed64cc953631a1122ac75

memory/1616-62-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

C:\Program Files (x86)\uTorrent\Tools\nircmdc.exe

MD5 2f9c7fda92c346cb5aa32091536ae0cb
SHA1 a3bbbba563eac751692ba814ada18c3f1c33dd9b
SHA256 f2bd35063b92a8f7d0f8d1a5448ff6836d22972fe3fe4a55fcaecafb7d4044cb
SHA512 90414a718453ddb1065f912c344f3774b1d1d5759aa5d86e6b31faee2ba92d26b2164212196b97611fccb52f50866540d0b7c1f2c4940cb494ff3fcbad090aad

C:\Program Files (x86)\uTorrent\Tools\new_put.cmd

MD5 1ab5193e7b9b72c36f6c048da59d2459
SHA1 3e0e1234f3e5dfb3b9f022c79d154088ae2e2fb0
SHA256 fb3d79b45c09155d1db042f261248d6d319e6d1e2851172ab26aae049d4f510e
SHA512 9b4f8a6f9c7ec0d3fba41f669661c6ae7f41314c8c0f06980400f792b20e07a24964b2222b59186ef916eff30e9283c66da2a4580d3a510940be07ac5fe3c90f

C:\Program Files (x86)\uTorrent\Tools\1.cmd

MD5 68cfcc4cfb4e56b3e67589295f39be00
SHA1 c7b6144b7a7670cd7eae75f4f3ce9471f72bbcfb
SHA256 cc25fe455a7ba68b52a8ccc47e4b15a5bd6bcdcf1043722d1524e5667f168717
SHA512 3832d3f05f41d1e85d032ca8b3e3556ce5cb300976227d3a0ae39e534eb38f7d7c334a348df8387a35450e514efd93947ae09b76ed9be1768be90db512d8fe04

memory/1616-66-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-68-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1616-69-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-70-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1616-71-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-76-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-86-0x0000000004AD0000-0x0000000004AD2000-memory.dmp

memory/1616-80-0x0000000002DC0000-0x0000000003E4E000-memory.dmp

memory/1616-98-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1616-97-0x0000000000400000-0x0000000000434000-memory.dmp